Kristoffer Dalby
81925d9d48
api/v2: require a token to hold a device's current tags to retag it
...
SetNodeTags replaces the tag set, so the tags it removes need the grant
too. A tag outside the grant answers 400, as on Tailscale SaaS.
2026-10-28 14:42:31 +00:00
Kristoffer Dalby
8d4adb66e3
api/v2: send empty route lists under fields=all
2026-10-28 14:42:30 +00:00
Kristoffer Dalby
412ef2726b
api/v2: name the join key in a device's oauthClientId
...
For a key a token made, Tailscale names the token's client, which is
not recorded, so the field is left out.
2026-10-28 14:42:30 +00:00
Kristoffer Dalby
1af4a51b74
api/v2: show a tagged device's creator as its user
...
A tagged device shows the login that made the key it joined with.
Its owner stays its tags.
2026-10-28 14:42:30 +00:00
Kristoffer Dalby
fb5802c878
api/v2: return a device name as its FQDN
2026-10-28 14:42:29 +00:00
Kristoffer Dalby
6360b4958c
api/v2: ignore unknown properties in request bodies
...
Tailscale's API ignores them.
2026-10-28 14:42:29 +00:00
Kristoffer Dalby
2e837a9072
api/v2: bound every request body
...
huma gives RawBody no limit, and validates a whole body before
the handler runs. The token form is parsed before the secret check.
2026-10-28 14:42:28 +00:00
Kristoffer Dalby
306a3d0f25
api, policy/v2: refuse route prefixes with host bits
...
Routes are matched as written, so such a prefix never equals the one a
client announces. The approval APIs answer 400 and autoApprovers refuses
it at load and write, with Tailscale's text.
2026-10-28 14:38:09 +00:00
Kristoffer Dalby
60d42808b8
state: keep node removal apart from policy refresh in DeleteNode
...
Peers get the deletion as an explicit PeersRemoved change, independent of
their sent-peers tracking.
Updates tailscale/tailscale#15660
2026-09-30 19:03:13 +02:00
Kristoffer Dalby
21f6e46fb8
state: refresh policy nodes inside the peer map build
...
One peer build per tag/user/IP/route write; callers detect policy moves
via NodesGeneration. Per-node caches only store results for the node
pm holds, so a mapper reading mid-build cannot pin a stale filter.
2026-09-30 17:21:02 +02:00
Kristoffer Dalby
fc6a16fdfc
state: preserve committed node deletion changes
...
Updates #3410
2026-09-09 18:18:17 +02:00
Kristoffer Dalby
84715e976c
api/v2: add OAuth client-credentials auth and scope enforcement
2026-06-26 09:18:06 +02:00
Kristoffer Dalby
b3472bb8dd
api/v2: add Tailscale-compatible devices API
...
Map the Tailscale device surface — get, list, delete, set name, tags,
key expiry, routes, and authorization — onto Headscale nodes.
2026-06-21 04:17:03 +02:00
Kristoffer Dalby
Kristoffer Dalby